Vulnerability · Published Aug 28, 2026 · Assigned by VulnCheck
CVE-2026-82253gitoxide before 0.82.0 Path Traversal via Submodule Name Validation Bypass
High 7.5
In plain English
A high-severity path traversal in gitoxide from GitoxideLabs. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 52% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
gitoxide (Rust crates gix <= 0.72.0 and gix-validate <= 0.10.0) contains a path traversal vulnerability. The submodule name validation function in gix-validate only checks the first occurrence of '..' via name.find(b".."), allowing crafted names such as 'a..b/../../../.git/' to bypass the check; additionally this validation is never invoked in production code paths. Combined with a trust inheritance flaw in Submodule::open(), where the parent repository's git_dir_trust (Trust::Full) is cloned and the ownership verification is skipped, an attacker can craft a malicious .gitmodules file so that a victim tool built on gitoxide reads arbitrary git repository configuration (including embedded credentials) with full trust, bypassing safe-directory protections. Fixed in gix 0.82.0 and gix-validate 0.11.1.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:13 | rust-gix | no fix listed | DEBIAN-CVE-2026-82253 |
| Debian:14 | rust-gix | 0.83.0-1 | DEBIAN-CVE-2026-82253 |
| Debian:13 | rust-gix-validate | no fix listed | DEBIAN-CVE-2026-82253 |
| Debian:14 | rust-gix-validate | 0.11.1-1 | DEBIAN-CVE-2026-82253 |
| Ubuntu:26.04:LTS | rust-gix | no fix listed | UBUNTU-CVE-2026-82253 |
| Ubuntu:26.10 | rust-gix | no fix listed | UBUNTU-CVE-2026-82253 |
| Ubuntu:24.04:LTS | rust-gix-validate | no fix listed | UBUNTU-CVE-2026-82253 |
| Ubuntu:26.04:LTS | rust-gix-validate | no fix listed | UBUNTU-CVE-2026-82253 |
| Ubuntu:26.10 | rust-gix-validate | no fix listed | UBUNTU-CVE-2026-82253 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| GitoxideLabs | gitoxide | 0 – before 0.82.0 |
| GitoxideLabs | gitoxide | 0 – before 0.11.1 |
Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
References
- GitHub Security Advisory (GHSA-p3hw-mv63-rf9w) vendor-advisory
- VulnCheck Advisory: gitoxide before 0.82.0 Path Traversal via Submodule Name Validation Bypass third-party-advisory